# CVE-2026-115403: Eclipse ThreadX NetX Duo NULL pointer dereference in IPv6 raw socket send

Source: https://junglewise.ai/threats/cve-2026-115403-in-eclipse-threadx-netx-duo-versions-6-0-through-6-5-2-202603a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-115403 · Severity: info · Published 2026-11-02

Eclipse ThreadX NetX Duo is a real-time operating system networking library used in embedded systems. Under specific conditions, when the IPv6 destination table is full, a remote attacker can send specially crafted IPv6 Packet Too Big messages to fill the table and trigger a NULL pointer dereference, causing the thread handling raw IPv6 socket sends to crash and potentially disrupting device functionality.

Technologies: [Eclipse Threadx Netx Duo](https://junglewise.ai/threats/technologies/threadx-netx-duo). Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-115403 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115403 being exploited in the wild.

**How severe is CVE-2026-115403?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** Eclipse Threadx Netx Duo 6.0 through 6.5.2.202603a.

**Is there a fix for CVE-2026-115403?** Yes: fixed in 6.5.2.202603b. Until then: Do not send raw IPv6 packets with IP_RAW_IPV6_HDRINCL to off-link destinations, or build without NX_BSD_RAW_SUPPORT enabled. Increasing NX_IPV6_DESTINATION_TABLE_SIZE will raise the number of destinations needed to trigger the condition but does not eliminate the defect. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115403 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115403?** Check whether you run Eclipse Threadx Netx Duo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.5.2.202603b

Do not send raw IPv6 packets with IP_RAW_IPV6_HDRINCL to off-link destinations, or build without NX_BSD_RAW_SUPPORT enabled. Increasing NX_IPV6_DESTINATION_TABLE_SIZE will raise the number of destinations needed to trigger the condition but does not eliminate the defect.

## Technical details

A NULL pointer dereference occurs in the _nxd_bsd_ipv6_packet_send function when sending IPv6 raw packets with header inclusion. The function adds a destination to the destination table without checking if the add succeeded; when the table is full or the neighbor cache cannot store the next hop, a NULL entry is returned and dereferenced. An attacker can remotely fill the destination table by sending ICMPv6 Packet Too Big messages to trigger the crash.

## Affected products

- Eclipse ThreadX NetX Duo 6.0 through 6.5.2.202603a

## Timeline

- 2026-11-01: disclosed

## References

- [https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9w9h-x3fh-m3fp](https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9w9h-x3fh-m3fp)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/500](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/500)

## Related threats

- [Eclipse ThreadX NetX Duo DTLS session pool exhaustion](https://junglewise.ai/threats/cve-2026-115215-in-eclipse-threadx-netx-duo-versions-6-0-through-6-5-2-202603a)
- [Eclipse ThreadX NetX Duo out-of-bounds read in MSRP attribute parsing](https://junglewise.ai/threats/cve-2026-102725-out-of-bounds-read-from-unvalidated-msrp-attribute-list-length)
- [A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A…](https://junglewise.ai/threats/cve-2025-55102-a-denial-of-service-vulnerability-exists-in-the-netx-ipv6)
- [In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client…](https://junglewise.ai/threats/cve-2025-55086-in-netxduo-version-before-6-4-4-a-networking-support-module-for)
- [In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the…](https://junglewise.ai/threats/cve-2025-55085-in-nextx-duo-before-6-4-4-in-the-http-client-module-the-network)